Extracted

• • Target

    Order Details_pdf.exe

  • Size

    663KB

  • MD5

    951a0a855a8bdec4bd6bfba0b116f4fb

  • SHA1

    5ca5b8fa973d1fdd1b5c669251123f6023cd2178

  • SHA256

    de006c9526937934142c1f991be7b89fe9d9fd6c080bc340e8fc542e850fd4f4

  • SHA512

    bd5cf4253fc12b76d6cfae7d920b84cf4cfa0078c7bdbeb41d9813cc8789b04c959788319f7bcae0f4ecc7ef2567cf360e7e46905afffb8c8f1f53e89ce609fe

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2